Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-09-2024 11:51
Static task
static1
Behavioral task
behavioral1
Sample
eb469bfdc41eec4b10d37328618a5983_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eb469bfdc41eec4b10d37328618a5983_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
eb469bfdc41eec4b10d37328618a5983_JaffaCakes118.dll
-
Size
42KB
-
MD5
eb469bfdc41eec4b10d37328618a5983
-
SHA1
3a256941f44029f895608aafc82e52321b284932
-
SHA256
621d540510c936fb3d60bb084886db8cc53df8ff9956f0da2c952a5274480783
-
SHA512
d87e225f4a629a18e9ad59eece8167602b8ef779b95bbbf5b0f869f95a1928e573a038ecd3d2b5901da9d3565bf5706ea96019392f425028478efd7db84fb584
-
SSDEEP
768:kp8NF1w8mn5/Wz75/I6z601Z9xbF99WSvAt6H3yY3eXp4RteMA/eo8x:kQU4t/Rzv7VWfAr4/epx
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1968 wrote to memory of 1372 1968 rundll32.exe 30 PID 1968 wrote to memory of 1372 1968 rundll32.exe 30 PID 1968 wrote to memory of 1372 1968 rundll32.exe 30 PID 1968 wrote to memory of 1372 1968 rundll32.exe 30 PID 1968 wrote to memory of 1372 1968 rundll32.exe 30 PID 1968 wrote to memory of 1372 1968 rundll32.exe 30 PID 1968 wrote to memory of 1372 1968 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eb469bfdc41eec4b10d37328618a5983_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eb469bfdc41eec4b10d37328618a5983_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1372
-